Hi @p.hruby , That is totally supported because that is basically the way a Stretched Fabric topology works: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/kb/b_kb-aci-stretched-fabric.html#concept_CCD894AB53B3433C930457088FBFE079   Remi Astruc ... View more

Hi @arif.malik38 , For your Campus LAN, he means several VRFs, one for each departement (or building, or high level security zones, ...). Each VRF has uplink to the L7 FW, which controls inter-zone traffic. Intra-VRF traffic can be controled with ACLs or SGTs. For the ACI part, from a technical perspective, the high level isolation is made with VRFs. A tenant is just a container of VRF(s), but is allows better manageability (all VRF-attached objects are under the same tree), easier cloning or deletion of VRF and subtree, and more granularity for Role-based Access to your Fabric resources. Using tenants also scales better because of some limits per tenant (e.g. max nb of EPGs, nb of L4-L7 device, etc...)   Remi Astruc ... View more

Hi @eugenia , It depends on the APIC generation you have. APIC-L2 and M2 support VIC 1225T which is an RJ45 card. But... these are End of Life: https://www.cisco.com/c/en/us/products/collateral/cloud-systems-management/application-policy-infrastructure-controller-apic/eos-eol-notice-c51-742143.html APIC-L3 and M3 seem to only support VIC 1455 (APIC-PCIE-C25Q-04) according to Cisco Commerce CCW. By the way, I really don't think you can use your Leaf Fabric ports for connecting the APIC.   Remi Astruc ... View more

Hello @p.hruby , The CSR 1000V is used to create an IPSec VPN with your on-premise ACI network to perform the BGP EVPN control plane in AWS, and route between VPCs. Here is the white paper explaining the Cloud APIC and CSR design and deployment: https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-741998.html   Remi Astruc ... View more

Hello @udo.konstantin, It may be that an interface assigned in that EPG is Blacklisted (similar to shutdown configuration). Go in Fabric > Inventory > Pod x > Node 222 > Interfaces > Physical Interfaces, and in the list of interfaces check if one has the status Blacklisted. In that case, right click it and "Enable".   Remi Astruc ... View more

Hi @bhayashi , Yes, there IS a problem. Besides the ACI matters, the ASA Firewall cannot have a subnet being at the same time directly attached to an interface and reachable via another interface.   Remi Astruc ... View more

Hello, Try to ignore the Fault for one minute. To do so, right-click the Fault and "Ignore Fault". Then revert the change by finding the created Fault Severity Assignment Policy and deleting it. Check if Fault is still there.   Remi Astruc ... View more

Hello, You have to follow the recommended downgrade path:   Current release:   4.0(3) Target release:   3.1(1) Recommended path:   4.0(3) → 3.2(1) → 3.1(1)   Procedure: Downgrade the Cisco APICs first. After the APICs are downgraded successfully, downgrade the switches using 2 or more maintenance groups. Caveats: With mixed operating system operation, you can have at most 2 different releases in the fabric at any given time. If the upgrade path contains one or more intermediate release hops,   the entire fabric must be upgraded to each intermediate release before any one element is upgraded to the next hop. When downgrading, you must remove any hardware that is not supported on the target release. If you have switch models N9K-X9736C-FX, N9K-C9508-FM-E2, N9K-C9348GC-FXP, and N9K-C9364C, do not downgrade to any version earlier than Release 3.0(1), because these models are not supported in any version earlier than Cisco APIC 3.0(1). If you are running APIC on APIC L3 or APIC M3 servers, do not downgrade to any version earlier than Release 4.0(1). If you have switch models N9K-X9736C-FX, N9K-C9508-FM-E2, N9K-C9348GC-FXP, and N9K-C9364C, do not downgrade to any version earlier than Release 3.0(1), because these models are not supported in any version earlier than Cisco APIC 3.0(1). Recommended software for target release: Cisco NX-OS ACI-mode version: 13.1(1) Cisco ACI Multi-Site version: 1.1(1) Cisco ACI Virtual Edge version: 1.1(1a) Cisco AVS version: 5.2(1)SV3(3.20) Cisco IMC version: UCS C220/C240 M3: 3.0(3e), UCS C220/C240 M4: 3.0(3f) Red Hat OSP version: 10 Canonical version: Ocata Software no longer supported on target release: CiscoAVS version(s): 5.2(1)SV3(3.40), 5.2(1)SV3(3.35), 5.2(1)SV3(3.29), 5.2(1)SV3(3.28), 5.2(1)SV3(3.27), 5.2(1)SV3(3.25), 5.2(1)SV3(3.21a), 5.2(1)SV3(3.21) CiscoAVE version(s): 2.0(2a), 2.0(1a), 1.2(6a), 1.2(4a), 1.2(3b), 1.2(3a), 1.2(2a), 1.2(1a), 1.1(2a) VMware vSphere version(s): 6.7 VMware vRealize version(s): 7.4 RedHatOSP version(s): 13, 12 Canonical version(s): Queens, Pike   Remi Astruc ... View more

Hello Nagis, Is the VPC to the ESXi server made of 2 links (one on each FEX) or more? Have you implemented the FEX/N9K in static pinning mode or Port-channel mode? (if unsure, run the command show fex XXX detail. If it shows Max-links: 1 and PoXX Interface Up, then it runs in Port-channel, otherwise in static-pinning).   Remi Astruc ... View more

Hello, "Create External Network" is not specific to dynamic routing. It is used to define the content of the External EPG attached to the L3Out. You will need it with static routes as well. Don't forget to add a contract between the External Network and other EPGs for it to work. "Routes Maps Profile" is indeed used for tweaking the advertisements and learning of dynamic routes, so you will not need it.   Remi Astruc ... View more